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Why GAO Did This Study 

To ensure that essential 
government services are available 
in emergencies, federal agencies 
are required to develop continuity 
of operations (COOP) plans. The 
Federal Emergency Management 
Agency (FEMA), within the 
Department of Homeland Security 
(DHS), is responsible for 
overseeing and assessing the status 
of COOP capabilities of federal 
executive branch agencies. It has 
developed guidance stating that 
agency COOP plans must designate 
alternate facilities and prepare 
personnel for unannounced 
relocation to these facilities. The 
guidance also states that agencies 
should consider the use of 
telework in their continuity plans. 

GAO was asked to follow up on its 
previous work on COOP planning 
and determine, among other things, 
to what extent (1) 6 selected 
agencies prepared their alternate 
facilities and (2) 23 major agencies 
made preparations necessary to 
effectively use telework in 
emergency situations. 



What GAO Recommends 



GAO is making recommendations 
to DHS aimed at improving the 
assessment and oversight of agency 
continuity planning and developing 
guidance on including telework in 
such planning. In commenting on a 
draft of this report, DHS partially 
agreed with GAO's 
recommendations and described 
actions to implement them. 



www.gao.gov/cgi-bin/getrpt7GAO-06-713. 

To view the full product, including the scope 
and methodology, click on the link above. 
For more information, contact Linda Koontz at 
(202) 512-6240 or koontzl@gao.gov. 



What GAO Found 

All six agencies GAO reviewed took steps to prepare their alternate facilities 
for use in emergencies. However, none of the agencies followed all of 
FEMA's guidance. For example, none conducted all the applicable tests and 
exercises, such as annual exercises that involve moving COOP personnel to 
alternate facilities. Further, agencies did not fully identify the resources 
necessary to support their essential functions, which reduces assurance that 
their facilities are adequately prepared. 

Although individual agencies are ultimately responsible for preparing their 
plans and alternate facilities, FEMA's limited efforts to oversee and assess 
agency COOP capabilities contributed to agencies' incomplete compliance 
with its guidance. According to an official from the Department of Homeland 
Security, FEMA recently developed a schedule of oversight activities that 
includes conducting assessments of agency continuity plans starting in July 
2006. However, the assessment's methodology is not yet finalized. If FEMA 
does not develop an assessment methodology that effectively evaluates 
agencies' compliance, it will have limited assurance that agencies have taken 
the steps necessary to ensure that they will be able to perform essential 
government operations following a disruption. 

Although agencies are not required to use telework in continuity planning, 
9 of the 23 agencies surveyed reported plans for essential team members to 
telework during a COOP event, compared with 3 in GAO's previous survey. 
However, few documented that they made the necessary preparations to 
effectively use telework during such an event (see table). For example, only 
one agency documented that it had notified its team members of their 
expectation to telework during a COOP event. The lack of specific guidance 
on preparations for telework during such an event contributed to the low 
levels of preparation that agencies reported. If agencies do not make 
adequate preparations, they may not be able to use telework effectively to 
ensure the continuity of their essential functions in emergencies. 

Agency Responses to Selected Questions on Telework in COOP Plans 



Question 


Year 


Yes 


Yes (no doc") 


No 


Are any of the agency's essential team members expected 


2005 


3 


6 


14 


to telework in a COOP event? 


2004" 


1 


2 


19 


Were staff informed of their responsibility to telework during 


2005 


1 


10 


12 


a COOP event? 


2004 


1 


3 


18 


Has the agency ensured that it has adequate technological 
capacity for staff to telework during a COOP event? 


2005 





14 


9 


2004 





5 


17 


Will the agency provide technological assistance to staff 


2005 


3 


11 


9 


during a COOP event? 


2004 





5 


17 


Has the agency tested the ability of staff to telework during a 










COOP event? 


2005 


3 


7 


13 




2004 





2 


20 



Source: GAO. 



a Agencies responded positively but did not provide adequate documentation in support. 
"In 2004, one agency did not respond, resulting in a total of 22 responses. 
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Abbreviations 

COOP continuity of operations 

DHS Department of Homeland Security 

FEMA Federal Emergency Management Agency 

FPC Federal Preparedness Circular 

OPM Office of Personnel Management 

PDD Presidential Decision Directive 
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United States Government Accountability Office 
Washington, DC 20548 



May 11, 2006 

The Honorable Tom Davis 
Chairman 

Committee on Government Reform 
House of Representatives 

Dear Mr. Chairman: 

As you know, essential government services can be interrupted by a range 
of events, including terrorist attacks, severe weather, or building-level 
emergencies. Federal agencies are required by Presidential Decision 
Directive (PDD) 67 to develop plans for ensuring the continuity of such 
services in emergency situations. This directive also designated the 
Federal Emergency Management Agency (FEMA) as lead agent for 
executive branch continuity of operations (COOP) planning, which 
includes the responsibility for formulating guidance on such planning and 
for assessing the status of executive branch COOP capabilities. 1 

In response, FEMA issued COOP guidance to agencies in July 1999: 
Federal Preparedness Circular (FPC) 65. The circular states that, in order 
to have a viable COOP capability, agencies should identify their essential 
functions, which then provide the basis for subsequent planning steps. The 
circular further states that agencies must designate alternate facilities as 
part of their continuity plans and prepare their personnel for the 
possibility of unannounced relocation of essential functions to these 
facilities. 

In June 2004, FEMA released an updated version of FPC 65, providing 
additional guidance to agencies on each of the topics covered in the 
original guidance, including an annex on alternate facilities. According to 
the guidance, an agency must identify an alternate facility that provides 
sufficient space for relocated personnel to perform essential agency 
functions during a COOP event. The guidance also directs agencies to 
identify the levels of staff and resources required at the alternate facility to 
support the performance of these functions. The identification of staff and 



^though the 2004 version of FPC 65 refers to FEMA as the "lead agent" for federal 
executive branch continuity efforts, the 1999 version used the term "executive agent." 
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resources — including equipment, critical information systems and data, 
and vital records — establishes the preparation requirements for an 
alternate facility. For example, in order for an agency to determine that it 
has an adequate number of computers present at the alternate facility, it 
must first establish how many are required to support personnel in the 
performance of essential functions. Once critical resources are identified, 
pre-positioning them is necessary to preparing an alternate facility. 

The 2004 version of FPC 65 also states that agencies should consider 
telework (also known as work-at-home or flexiplace) as an option in their 
COOP planning. Although FPC 65 does not require agency plans to 
incorporate telework, using this option can allow employees to contribute 
to the performance of agency essential functions without having to 
physically relocate to an alternate operating facility. As we reported in 
April 2004, telework is an important and viable option for federal agencies 
in continuity planning and implementation efforts, especially as the 
duration of an emergency event is extended. 2 We recommended in that 
report that the Secretary of Homeland Security direct the Under Secretary 
for Emergency Preparedness and Response to complete efforts to revise 
federal COOP guidance to more fully address human capital 
considerations by incorporating six organizational actions, the scope of 
which included telework. 

In 2002 and 2004, we reviewed the extent to which agency COOP plans 
complied with FEMA's continuity guidance at the request of the Chairman, 
House Committee on Government Reform. In both reviews, we reported 
that agency plans did not generally comply with FEMA's guidance. In 2004, 
we also surveyed agencies to determine how they planned to use telework 
during COOP events and reported that, although agencies were not 
required to address telework in their continuity plans, 2 of the 22 
responding agencies did so in the plans that were in place on May 1, 2004. 3 

For the current review, as agreed with the committee, our objectives were 
to determine to what extent agencies have 



2 GAO, Human Capital: Opportunities to Improve Federal Continuity Planning 
Guidance, GAO-04-384 (Washington, D.C.: Apr. 20, 2004). 

3 GAO, Continuity of Operations: Agency Plans Have Improved, but Better Oversight 
Could Assist Agencies in Preparing for Emergencies, GAO-05-577 (Washington, D.C.: 
Apr. 28, 2005); and Continuity of Operations: Agency Plans Have Improved, but Better 
Oversight Could Assist Agencies in Preparing for Emergencies, GAO-05-619T 
(Washington, D.C.: Apr. 28, 2005). 
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• prepared alternate facilities where they can perform their essential 
functions in emergencies and 

• made preparations necessary to effectively use telework in emergency 
situations. 

To achieve our first objective, we obtained and reviewed headquarters 
contingency plans from 23 of the largest civilian departments and agencies 
to identify the population of alternate facilities; verified alternate facilities 
information with each agency; and selected, from the population of 
alternate facilities, six alternate facilities illustrating variations in several 
attributes, including agency budget size, distance from respective primary 
work facility, and facility type. For the selected alternate facilities, we 
evaluated compliance with FPC 65 criteria by analyzing agency COOP 
plans and other documentation and by visiting alternate facilities. Finally, 
we obtained and analyzed FEMA's COOP guidance and documents 
describing its efforts to provide oversight and assessments of federal 
planning efforts, and conducted interviews with FEMA officials to clarify 
the activities described in these documents. 

For our second objective, we reviewed prior GAO work on telework to 
determine key practices for the development of an effective telework 
program; developed a series of questions regarding agency plans and 
preparations to use telework during a COOP event; surveyed agency 
officials responsible for continuity planning at 23 of the largest civilian 
departments and agencies to determine to what extent key telework 
practices were used in making continuity preparations; reviewed 
supporting documentation submitted by agency officials to support their 
responses; and created tables that compared this year's survey responses 
with those from our previous survey in 2004. 

We conducted our review between July 2005 and February 2006 in the 
Washington, D.C., area and at several agency alternate facilities in 
accordance with generally accepted government auditing standards. 

On April 13, we provided your office with a classified briefing on the 
results of this review. The purpose of this letter is to provide you with the 
unclassified material from our briefing. (See app. I.) 

In summary, all six agencies we reviewed had identified alternate facilities 
and took steps to prepare their alternate facilities for use in emergencies. 
For example, most agencies documented plans and procedures related to 
these facilities, including site preparation and activation plans. However, 
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none of the agencies followed all of FEMA's guidance. For example, none 
conducted all of the applicable tests and exercises outlined in FPC 65, 
including annual exercises that incorporate the deliberate and preplanned 
movement of COOP personnel to the agencies' alternate facilities. Further, 
agencies did not fully identify the levels of resources necessary to support 
their essential functions (e.g., the number of computers to support the 
performance of essential functions), creating a lack of assurance that the 
agencies' facilities are adequately prepared. 

Although each agency is responsible for developing a viable COOP plan 
and ensuring that its alternate facilities are adequately prepared, FEMA's 
limited efforts to oversee and assess agency COOP capabilities 
contributed to the agencies' lack of compliance with all of the FPC 65 
guidance. For example, FEMA has continued to rely on agency-reported 
information as the basis for its assessments. In addition, two planned 
oversight efforts — a readiness reporting system operated by FEMA and a 
review of agency essential functions by the White House — have been 
delayed. 

According to an official from the Department of Homeland Security 
(DHS) — the parent agency of FEMA — FEMA plans to expand its oversight 
activities to include the evaluation and assessment of individual agency 
COOP capabilities. As part of the methodology for an upcoming 
interagency exercise, known as Forward Challenge 06, FEMA officials 
anticipate using independent observers to evaluate agency plans and their 
implementation during the exercise. In addition, officials plan to conduct 
individual agency COOP assessments starting in July 2006. However, 
details regarding the assessment's methodology have yet to be finalized. If 
FEMA does not develop an assessment methodology that evaluates 
agencies' compliance with FPC 65 — including the extent to which agencies 
(1) identify essential functions; (2) identify the levels of staff and 
resources required at their alternate facilities; and (3) plan, conduct, and 
document the necessary tests and exercises at the appropriate scope and 
frequency — it will have limited assurance that agencies have taken the 
steps necessary to ensure that they will be able to perform essential 
government operations following a disruption. 

Finally, more agencies reported plans for essential team members to 
telework during a COOP event than in our previous survey, but few 
documented that they made the necessary preparations to effectively use 
telework during an emergency. Nine of the 23 agencies reported that some 
of their essential team members are expected to telework during such an 
event. However, only 1 agency documented that it had communicated this 
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expectation to its emergency team members. In addition, only 3 of the 23 
agencies documented testing the ability of staff to telework during a COOP 
event. 



The lack of specific guidance on the steps that agencies should take to 
ensure that they are fully prepared to use telework during a COOP event 
contributed to the low levels of preparation that agencies reported. FEMA 
recently disseminated guidance to agencies regarding the incorporation of 
pandemic influenza considerations into COOP planning. However, while 
the guidance does suggest the use of telework during such an event, it 
does not address the steps agencies should take when preparing to use 
telework during a COOP event. If agencies do not make adequate 
preparations, they may not be able to use telework effectively to ensure 
the continuity of their essential functions in emergencies. 



Recommendations for ^° ensure *^ a * a § enc i es are adequately prepared to continue performing 

essential functions following an emergency, we recommend that the 

Executive Action Secretary of Homeland Security direct the FEMA Director to improve the 

oversight of agency COOP planning by taking the following three actions: 

• Before the upcoming interagency exercise, conduct an assessment of the 
COOP plans of the six agencies whose alternate facilities were included in 
our review and report any deficiencies to the head of the agency for 
correction. 

• Develop a methodology for individual agency COOP assessments that 
independently evaluates executive branch agencies' compliance with FPC 
65, including the extent to which agencies (1) identify essential functions; 
(2) identify the levels of staff and resources required at their alternate 
facilities; and (3) plan, conduct, and document the necessary tests and 
exercises at the appropriate scope and frequency. The methodology 
should include a mechanism for reporting any deficiencies to the head of 
the agency for correction. 

• Establish a time line for developing, in consultation with the Office of 
Personnel Management (OPM), guidance on the steps that agencies should 
take to adequately prepare for the use of telework during a COOP event. 



ASenCV Comments ^ e rece ^ ve( ^ written comments on a draft of our report from the Director 

o «y of the Department of Homeland Security's GAO/OIG Liaison Office. (These 

and Our Evaluation 
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comments are reproduced in app. II.) In commenting on the report, the 
Director stated that DHS partially agreed with our recommendations. 

In commenting on oversight of COOP planning, the Director wrote that 
PDD 67 directed that an interagency advisory group shall provide 
coordination, oversight, and management for COOP-related activities of 
executive branch agencies. He added that although FEMA is designated as 
chair of this group, participating agency coordinators are designated with 
the authority to represent and commit their agencies in COOP-related 
matters. However, as we point out in our report, according to FPC 65, the 
presidential directive also established FEMA as the lead agency for 
executive branch continuity planning. Included in this responsibility is the 
specific requirement for FEMA to oversee and assess the status of COOP 
capabilities of executive branch agencies. 

In responding to our first recommendation, the Director stated that DHS 
partially agreed and that FEMA will be conducting assessments of the six 
agencies in conjunction with its upcoming interagency exercise. 

Regarding our recommendation on developing an assessment 
methodology, the Director wrote that FEMA currently has an assessment 
program and a methodology that includes (1) a self-assessment tool to 
assist senior leaders in performing internal assessments, (2) the 
governmentwide exercise planned for June 2006, and (3) a plan for an 
expanded comprehensive department and agency assessment program. He 
added that FEMA plans to continually refine this methodology and expand 
the program through additional funding and resources. In addition, the 
Director stated that the agency's efforts are constrained by resources. He 
stated that to improve the readiness of the federal government's COOP 
program, additional resources are required to support the large number of 
federal offices and facilities that could benefit from recurring COOP 
assessments. 

However, while these steps outline an overall approach to assessing 
agency plans, they do not constitute a methodology for assessing agency 
compliance with FPC 65 — including the extent to which agencies (1) 
identify essential functions; (2) identify levels of staff and resources 
required at their alternate facilities; and (3) plan, conduct, and document 
the necessary tests and exercise at the appropriate scope and frequency, 
as we have recommended. Without such a methodology, the agency will 
have limited assurance that agencies have taken the necessary steps to 
prepare for an emergency. While we did not review the adequacy of 
FEMA's resources for conducting oversight of agency planning, DHS 
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should review how FEMA prioritizes its currently available funding for 
COOP activities and to the extent it agrees that additional funding is 
needed, pursue justifying increases. 

In responding to our recommendation on developing guidance on 
agencies' use of telework, the Director partially agreed and stated that 
FEMA will coordinate with OPM in the development of a timeline for 
further telework guidance. In addition, he stated that both FEMA and OPM 
have provided guidance on the use of telework. However, as stated in our 
report, present guidance does not address the preparations agencies 
should make for using telework during emergencies and it is unclear 
whether and when FEMA will release such guidance. 

The Director also included technical comments that we have addressed, as 
appropriate. 



We are sending copies of this report to the appropriate congressional 
committees, the Secretary of Homeland Security, and the Director of the 
Office of Personnel Management, and will make copies available to others 
on request. In addition, the report will be available at no charge on the 
GAO Web site at http://www.gao.gov. 

If you or your staff have any questions about this report, please contact me 
at (202) 512-6240 or koontzl@gao.gov. Key contributions to this report 
were made by James R. Sweetman Jr., Assistant Director; Barbara Collier; 
Nick Marinos; and Kim Zelonis. 

Sincerely yours, 




Linda D. Koontz 

Director, Information Management Issues 
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Appendix I: Unclassified Version of April 13, 
2006, Briefing to Staff of the House 
Committee on Government Reform 
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Continuity of Operations: Selected Agencies Could Improve 
Planning for Use of Alternate Facilities and Telework During 
Disruptions 



Briefing for the Staff of the 
Committee on Government Reform, 
House of Representatives 



April 13, 2006 



1 
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Appendix I: Unclassified Version of April 13, 
2006, Briefing to Staff of the House 
Committee on Government Reform 
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Outline of Briefing 


Introduction 




Objectives, Scope, and Methodology 




Results in Brief 




Background 




Results 




• Alternate Facilities Compliance 




• Telework 




Conclusions 




Recommendations 




Agency Comments and Our Evaluation 




Attachment 1: Agencies Participating in Telework Survey 
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Appendix I: Unclassified Version of April 13, 
2006, Briefing to Staff of the House 
Committee on Government Reform 
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Introduction 



Federal operations and facilities have been disrupted by a range of events, including 

• the terrorist attacks on September 1 1 , 2001 , and at Oklahoma City; 

• severe weather events, such as hurricanes Katrina, Rita, and Wilma in 2005; and 

• building-level events, such as asbestos contamination at the Department of the Interior's 
headquarters. 

Such disruptions, particularly if prolonged, can lead to interruptions in essential government 
services. Prudent management, therefore, requires that federal agencies develop plans for 
ensuring the continuity of such services in emergency situations. These are referred to as 
continuity of operations (COOP) plans. These plans lay out an agency's approach to 
maintaining services, ensuring proper authority for government actions, and protecting vital 
assets. 
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Appendix I: Unclassified Version of April 13, 
2006, Briefing to Staff of the House 
Committee on Government Reform 



k GAP 

Accountability * Integrity * Reliability 



Introduction 



In October 1998, Presidential Decision Directive (PDD) 67 identified the Federal Emergency 
Management Agency (FEMA) as the executive agent for federal COOP planning across the 
federal executive branch. 

FEMA's responsibilities include 

• formulating guidance for agencies to use in developing viable plans, 

• coordinating interagency exercises and facilitating interagency coordination as 
appropriate, and 

• overseeing and assessing the status of COOP capabilities across the executive branch. 

In July 1999, FEMA first issued Federal Preparedness Circular (FPC) 65. FPC 65 is 
guidance to the federal executive branch for use in developing viable and executable 
contingency plans that facilitate the performance of essential functions during any 
emergency. Some of the elements of a viable continuity of operations capability, according to 
the guidance, include the identification of essential functions; provision for alternate facilities; 
provision of interoperable communications; availability of vital records; and conduct of 
regular tests, training, and exercises. 
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Appendix I: Unclassified Version of April 13, 
2006, Briefing to Staff of the House 
Committee on Government Reform 
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Introduction 



FEMA released an updated version of FPC 65 in June 2004, providing additional guidance to 
agencies on each of the topics covered in the original guidance, including an annex on 
alternate facilities. The annex states that all agencies must designate alternate operating 
facilities as part of their COOP plans and prepare their personnel for the possibility of an 
unannounced relocation to these facilities. When agencies identify and prepare their 
alternate facilities, they should consider a number of items, including geographical location of 
the facility, the availability of necessary logistics and infrastructure, and the safety and 
security of relocated personnel, in an effort to ensure that essential operations can be 
performed during an emergency. 

Telework can allow employees to contribute to the performance of agency essential 
functions without having to physically relocate to an alternate operating facility. Although the 
2004 version of FPC 65 does not require agencies to use telework (also known as work-at- 
home or flexiplace) as an element of their COOP planning, it states that agencies should 
consider telework as an option. According to the Office of Personnel Management's (OPM) 
guidance on Washington, D.C., area closures, one of the major benefits of a telework 
program is the ability of employees to continue working at their alternative work sites during 
a disruption to operations. 1 In recognition of the growing importance of teleworkers to the 
continuity of agency operations, OPM states that agencies may require personnel to telework 
when the agency is closed. 

1 OPM, Washington, DC, Area Dismissal or Closure Procedures (Washington, D.C.: November 2005). 
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Appendix I: Unclassified Version of April 13, 
2006, Briefing to Staff of the House 
Committee on Government Reform 
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Objectives 

In 2002 and 2004, we reviewed agency COOP plan compliance with FEMA's guidance at the 
request of the Chairman, House Committee on Government Reform. In both reviews we 
reported that agency plans did not generally comply with FEMA's guidance. In 2004, we also 
conducted a survey of agency planned use of telework during COOP events and reported 
that, although not required to do so, 2 of the 22 responding agencies addressed telework in 
the continuity plans that were in place on May 1 , 2004. 

For the current review, as agreed with the Committee, our objectives were to determine to 
what extent agencies have 

• prepared alternate facilities where they can perform their essential functions in 
emergencies and 

• made preparations necessary to effectively use telework in emergency situations. 
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To assess the preparation of agency alternate facilities, we 

• obtained and reviewed headquarters contingency plans from 23 of the largest civilian 
departments and agencies to identify the population of alternate facilities; 

• verified alternate facilities information with each agency; 

• selected, from the population of alternate facilities, six alternate facilities illustrating 
variations in several attributes, including agency budget size, distance from respective 
primary work facility, and facility type; 1 

• for the selected alternate facilities, evaluated compliance with FPC 65 guidance through 
analysis of agency COOP plans, other documentation, and through observation during 
alternate facility visits; and 

• obtained and analyzed FEMA's COOP guidance and documents describing its efforts to 
provide oversight and assessments of federal planning efforts, and conducted interviews 
with FEMA officials to clarify the activities described in these documents. 



1 Because of the method of selection for the six alternate facilities we reviewed, we cannot conclude that our results represent 
any larger group of alternate facilities. However, the six facilities we reviewed illustrate some of the ways in which agencies 
comply with FPC 65 guidance related to alternate facility identification and preparation. 
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2006, Briefing to Staff of the House 
Committee on Government Reform 
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For each of the six selected agency alternate facilities, we assessed compliance with FPC 65 
guidance using questions based on the guidance. These questions address topics related to 
the preparation of an alternate operating facility: 

• site selection; 

• facility plans and procedures; 

• employee health, safety, security, and emotional well-being; 

• space; 

• equipment; 

• vital records; 

• voice and data communications; and 

• tests and exercises. 

These eight areas are our categorization of topics covered in the FEMA guidance on 
alternate facilities. Each topic area included two to seven questions. 
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We used the following steps to evaluate each agency alternate facility's compliance and 
assign answers to each of the questions: 

• Documents were reviewed and compared independently by two analysts. A third analyst 
reviewed documentation where the initial two could not reach consensus. 

• Initial assessments were shared with each agency during structured interviews. 

• Agency officials had the opportunity to provide additional documentation to demonstrate 
compliance. 

• Analysts then visited alternate facilities to measure compliance with agency plans and 
continuity guidance (e.g., identify the pre-positioning of equipment at the facilities). 

• Any supplemental information provided by the agencies was again reviewed by multiple 
analysts. 
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Based on the agency contingency plans, other related documents, and physical observation 
during facility visits, we used content analysis to assign answers to the FPC 65-based 
questions. Answers were assigned as follows: 

• yes (compliant with all of the guidance related to that question), 

• no (not compliant with any of the guidance related to that question), 

• partial (compliant with some, but not all of the guidance). 

Based on this analysis, we created tables that summarized the results of the six 
assessments. In some cases, agencies had not established clear requirements (for example, 
they did not fully identify the necessary equipment, vital records, or number of personnel 
needed to perform essential functions from their alternate facilities). In those cases, we were 
unable to determine compliance; these are indicated by footnotes in our summary tables. 



10 



Page 17 



GAO-06-713 Continuity of Operations 



Appendix I: Unclassified Version of April 13, 
2006, Briefing to Staff of the House 
Committee on Government Reform 



A A (~\ Objectives, Scope, and Methodology 

p. uAU 



Accountability * Integrity * Reliability 



To accomplish our objective on the use of telework, we 

• reviewed prior GAO work on telework 1 to determine key practices for the development of 
an effective telework program; 

• developed a series of questions regarding agency plans to use telework during a COOP 
event; 

• surveyed agency officials responsible for continuity planning at 23 of the largest civilian 
departments and agencies 2 to determine to what extent telework key practices were 
used in making continuity preparations; 

• reviewed supporting documentation submitted by agency officials to support their 
responses; and 

• created tables that compared this year's survey responses with those from our previous 
survey in 2004. 3 

We conducted our review between July 2005 and February 2006 in the Washington, D.C., 
area and at several agency alternate facilities, in accordance with generally accepted 
government auditing standards. 

1 GAO, Human Capital: Further Guidance, Assistance, and Coordination Can Improve Federal Telework Efforts, GAO-03-679 
(Washington, D.C.: July 18, 2003). 

2 The 23 agencies that participated in the survey are listed in attachment 1 . 

3 GAO, Continuity of Operations: Agency Plans Have Improved, but Better Oversight Could Assist Agencies in Preparing for 
Emergencies, GAO-05-577 (Washington, D.C.: Apr. 28, 2005). 
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All six agencies we reviewed took steps to prepare their alternate facilities for use in 
emergencies. For example, most agencies documented plans and procedures related to 
these facilities, including site preparation and activation plans. However, none of the 
agencies followed all of FEMA's guidance. For example, none conducted all the applicable 
tests and exercises required by FPC 65, including annual exercises that incorporate the 
deliberate and preplanned movement of COOP personnel to an alternate facility. Further, 
agencies did not fully identify the levels of resources necessary to support their essential 
functions, creating a lack of assurance that their facilities are adequately prepared. 

While individual agencies are responsible for developing a viable COOP plan and ensuring 
that their alternate facilities are adequately prepared, FEMA's limited efforts to oversee and 
assess agency COOP capabilities contributed to agencies' lack of compliance with all of the 
FPC 65 guidance. For example, FEMA has continued to rely on agency-reported information 
as the basis for its assessments. In addition, two planned oversight efforts — a readiness 
reporting system operated by FEMA and a review of agency essential functions by the White 
House — have been delayed. 
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FEMA recently developed a schedule of COOP oversight activities that includes conducting 
individual agency COOP assessments starting in July 2006. However, details regarding the 
assessment's methodology have yet to be finalized. If FEMA does not develop an 
assessment methodology that evaluates agencies' compliance with FPC 65 — including the 
extent to which agencies (1) identify essential functions, (2) identify the levels of staff and 
resources required at their alternate facilities, and (3) plan, conduct, and document the 
necessary tests and exercises at the appropriate scope and frequency — it will lack 
assurance that agencies have taken the steps necessary to ensure that they will be able to 
perform essential government operations following a disruption. 
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More agencies reported plans for essential team members to telework during a COOP event 
than in our previous survey, but few documented that they made the necessary preparations 
to effectively use telework during an emergency. While FPC 65 does not require agencies to 
telework during a COOP event, it does state that they should consider the use of telework in 
their continuity plans and procedures. All of the 23 agencies that we surveyed indicated that 
they considered telework as an option during COOP planning. In addition: 

• 9 of the 23 agencies reported that some of their COOP essential team members are 
expected to telework during a COOP event. However, only 1 agency documented that it 
had notified its team members of their expectation to telework during a COOP event. 

• None of the 23 agencies demonstrated that they can ensure adequate technological 
capacity to allow designated personnel to telework during a COOP event. 

• Only 3 of the 23 agencies documented testing the ability of staff to telework during a 
COOP event. 

The lack of specific guidance from FEMA on the preparations necessary to ensure an 
effective telework program contributed to the low levels of preparation that agencies 
reported. If agencies do not make adequate preparations, they may not be able to use 
telework effectively to ensure the continuity of their essential functions in emergencies. 
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We are making recommendations to the Secretary of Homeland Security aimed at improving 
the assessment and oversight of agency continuity planning and developing guidance on 
including telework in such planning. 

In written comments provided on a draft of this briefing, the Director of the Department of 
Homeland Security's GAO/OIG Liaison Office commented that departments and agencies 
are responsible for their own COOP plans. We agree and we clarified the briefing to reflect 
this point. The Director also commented on recent actions FEMA has taken to fulfill its 
responsibilities for executive branch continuity planning. The Director's comments, however, 
did not address FEMA's responsibility to oversee and assess the status of COOP capability 
across the federal executive branch, which is outlined in FPC 65. Finally, the Director 
identified recent guidance related to telework. However, none of the guidance addresses the 
preparations agencies should take to use telework effectively during an emergency. 
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In 1988, Executive Order 12656 established policy for preparedness to address emergencies 
that affect national security, including technological emergencies and natural disasters. The 
order identified the National Security Council as the agency responsible for developing and 
administering a national security emergency preparedness policy, with the assistance of 
FEMA. 

In October 1998, according to FEMA officials, PDD 67 established a requirement that 
agencies have COOP plans in place by October 1999. It identified FEMA as the executive 
agent for federal COOP planning across the federal executive branch, responsible for 
formulating guidance for agencies to use in developing viable plans, coordinating interagency 
exercises and facilitating interagency coordination as appropriate, and overseeing and 
assessing the status of COOP capabilities across the executive branch. FEMA's Office of 
National Security Coordination executes these COOP responsibilities. 

In July 1999, FEMA issued FPC 65 to assist agencies in meeting the deadline established by 
the directive. The guidance stated that COOP planning should address any emergency or 
situation that could disrupt normal operations, including localized emergencies; thus, it 
extended the scope of the required planning beyond the national emergencies described in 
the Executive Order. The guidance included topic areas such as plans and procedures; 
identification of essential functions; delegations of authority; orders of succession; alternate 
facilities; interoperable communications; vital records and databases; and tests, training, and 
exercises. In June 2004, FEMA released an updated version of FPC 65, providing additional 
guidance to agencies on each of the topics covered in the original guidance. 
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FPC 65 states that agencies must identify essential functions and develop plans that ensure 
that these functions will resume within 12 hours of COOP activation and continue for up to 30 
days. The guidance states that the identification and prioritization of essential functions are 
prerequisites for continuity planning because these establish the parameters that drive the 
agency's efforts in all other planning areas. 

Furthermore, the guidance states that an agency must identify an alternate facility that 
provides sufficient space for relocated personnel to perform agency essential functions. The 
guidance also directs agencies to identify the levels of staff and resources required at the 
alternate facility to support the performance of these functions. The identification of staff and 
resources — including equipment, critical information systems and data, and vital records — 
establishes the preparation requirements for an alternate facility. For example, in order for an 
agency to determine that it has an adequate number of computers present at the alternate 
facility, it must first establish how many are required to support personnel in the performance 
of essential functions. Once critical resources are identified, pre-positioning them is 
necessary to preparing an alternate facility. 

The guidance requires agencies to review their alternate facilities for suitability and 
functionality. Tests and exercises allow specific aspects of COOP plans, procedures, and 
facilities to be assessed, validated, or identified for subsequent correction. Periodic testing 
also ensures that equipment and procedures are maintained in a constant state of readiness. 
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The guidance states that an agency must select an alternate facility and develop site 
preparation and activation plans that provide the agency with the capability to perform its 
essential functions within 12 hours of COOP activation. The following bullets categorize key 
areas identified in FPC 65 that an agency must consider when selecting and preparing its 
alternate facility: 

Site selection. Before an agency selects a location for its alternate facility, it should 
perform an all-hazard risk assessment for each facility considered to determine, among 
other things, any natural hazards that may affect the facility and the ability to secure the 
facility against crime, sabotage, and terrorist attacks. When selecting a location, an 
agency should consider access to essential resources— such as food, water, and fuel— 
from the alternate facility. Finally, the agency should be able to run emergency power at 
the facility. 

Facility plans and procedures. An agency must have detailed site preparation and 
activation plans in order to achieve full operational capability within 12 hours of 
notification. An agency must have plans (1) for notifying its alternate facility upon COOP 
activation of plans to relocate, (2) for reception and in processing of COOP personnel 
upon arrival, and (3) to address housing for the relocated personnel. 

Employee health, safety, security, and emotional well-being. An agency must 
provide consideration for the health, safety, and emotional well-being of its relocating 
COOP personnel, and ensure that physical security at the alternate facility meets all 
requirements established by annual threat assessments and physical security surveys. 
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Space. An agency should ensure that space at its alternate facility is adequate for 
supporting the number of relocating COOP personnel identified in the agency's staffing 
plans. 

Equipment. An agency should identify the critical resources — including information 
technology (IT) and telecommunications equipment — needed to perform essential 
functions. An agency must pre-position critical resources at its alternate facility and have 
procedures for ordering equipment not already in place. 

Vital records. Agency personnel must have access to electronic and hard-copy vital 
records and databases needed to perform the agency's essential functions from the 
alternate facility. In order for an agency to establish access requirements for vital records 
and databases at the alternate facility, it must develop a vital records inventory with 
location and access information for each vital record. 

Voice and data communications. An agency must have redundant communications 
providing the capability to communicate with key contacts, including agency staff, critical 
customers, and the public. It must also provide access to a local area network, electronic 
vital records, critical information systems and data, and internal and external e-mail and 
archives. 

Tests and exercises. An agency must conduct and document tests and exercises of its 
COOP plans and procedures to ensure that, among other things, requirements at the 
alternate facility are adequate for performing essential functions. 
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We previously reported on federal agency headquarters contingency plans in place in May 
2004 at the request of the Chairman, House Committee on Government Reform. 1 At that 
time, we determined that agencies had made progress in improving compliance with FPC 65, 
but significant weaknesses remained. For example, only 3 out of the 45 agency COOP plans 
we reviewed documented that their alternate facilities could provide previously identified 
equipment and space for COOP personnel responsible for performing essential functions. In 
addition, only 8 out of 45 COOP plans we reviewed adequately documented that the 
agencies could provide interoperable communications from their alternate facilities with 
internal and external organizations, critical customers, and the public. 

During our previous reviews of agency COOP plans, we reported that insufficient oversight 
by FEMA contributed to agencies' lack of compliance with the continuity guidance. 
Specifically, we noted that FEMA had not conducted an assessment of agency contingency 
plans since 1999. In response, FEMA officials reported that they were developing a 
readiness reporting system — a system used to collect data from agencies on the readiness 
of their continuity plans that would evaluate compliance with the guidance — which was to be 
completed in March 2005. The system was expected to be operational and certified by 
October 2005, at which time there would be seven locations (including two FEMA locations) 
using the system. 

1 GAO, Continuity of Operations: Agency Plans Have Improved, but Better Oversight Could Assist Agencies in Preparing for 
Emergencies, GAO-05-577 (Washington, D.C.: Apr. 28, 2005) and Continuity of Operations: Agency Plans Have Improved, 
but Better Oversight Could Assist Agencies in Preparing for Emergencies, GAO-05-619T (Washington, D.C.: Apr. 28, 2005). 
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Telework, also referred to as telecommuting or flexiplace, has gained widespread attention 
over the past decade in both the public and private sectors as a human capital flexibility that 
offers a variety of potential benefits to employers, employees, and society. In a 2003 report 
to Congress on the status of telework in the federal government, the Director of OPM 
described telework as "an invaluable management tool which not only allows employees 
greater flexibility to balance their personal and professional duties, but also allows both 
management and employees to cope with the uncertainties of potential disruptions in the 
workplace, including terrorist threats." 1 The 2005 OPM report on telework notes the 
importance of telework in responding flexibly to emergency situations, as demonstrated in 
the wake of the devastation caused by Hurricane Katrina, when telework served as a tool to 
help alleviate the issues caused by steeply rising fuel prices nationwide. 2 



1 0PM, Report to the Congress: The Status of Telework in the Federal Government (Washington, D.C.: January 2003). 
2 OPM, Report to the Congress: The Status of Telework in the Federal Government (Washington, D.C.: 2005). 
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According to OPM's guidance on Washington, D.C., area closures, one of the major benefits 
of a telework program is the ability of employees to continue working at their alternative work 
sites during a disruption to operations. 1 In recognition of the growing importance of 
teleworkers to the continuity of agency operations, OPM states that agencies may require 
personnel to telework when the agency is closed. According to OPM guidance, telework 
enabled employees to continue working after being displaced during events such as the 
terrorist attacks and subsequent anthrax problems of 2001 . 2 

In November 2005, the White House issued a national strategy to address the threat of 
pandemic influenza. 3 The strategy states that social distancing measures may be 
appropriate public health interventions for infection control and containment during a 
pandemic outbreak. Telework is an example of social distancing. The strategy requires 
federal departments and agencies to develop and exercise preparedness and response 
plans that take into account the potential impact of a pandemic on the federal workforce. It 
also tasks the Department of Homeland Security (DHS) — the parent department of FEMA — 
with developing plans to implement the strategy in regard to domestic incident management 
and federal coordination. 

1 0PM, Washington, DC, Area Dismissal or Closure Procedures (Washington, D.C.: November 2005). 

2 OPM, Telework: A Management Priority, A Guide for Managers, Supervisors, and Telework Coordinators (Washington, 
D.C.: May 2003). 

3 Homeland Security Council, National Strategy for Pandemic Influenza (Washington, D.C.: Nov. 1 , 2005). 
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As we reported in April 2004, telework is an important and viable option for federal agencies 
in COOP planning and implementation efforts, especially as the duration of an emergency 
event is extended. 1 In a July 2003 report, we defined 25 key telework practices for 
implementation of successful federal telework programs. 2 

In our April 2005 report on continuity of operations, we reported that although agencies were 
not required to use telework in their continuity plans, 1 of the 21 agency continuity plans in 
place on May 1 , 2004, documented the agency's intention to address some essential 
functions through telework. 3 In addition, 10 agencies reported that they intended to use 
telework following a COOP event, but those intentions were not documented in their 
continuity plans. The plans reviewed were created before the issuance of FEMA's revised 
continuity planning guidance, which includes the recommendation that agencies consider 
options such as work-at-home and virtual offices when establishing continuity plans. 



1 GAO, Human Capital: Opportunities to Improve Federal Continuity Planning Guidance, GAO-04-384 (Washington, D.C.: Apr. 
20, 2004). 

2 GAO, Human Capital: Further Guidance, Assistance, and Coordination Can Improve Federal Telework Efforts, GAO-03-679 
(Washington, D.C.: July 18, 2003). 

3 GAO, Continuity of Operations: Agency Plans Have Improved, but Better Oversight Could Assist Agencies in Preparing for 
Emergencies, GAO-05-577 (Washington, D.C.: Apr. 28, 2005). 
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All six agencies we reviewed took steps to prepare their alternate facilities using practices 
identified in the FPC 65 guidance. Agency use of these practices, which fall into the eight 
topic areas presented earlier, are presented in the following slides. 

Among the eight areas, the extent to which agencies performed the practices varied. For 
example, most agencies documented plans and procedures related to their alternate 
facilities, including site preparation and activation plans. In contrast, none conducted all the 
applicable tests and exercises required by FPC 65, including annual exercises that 
incorporate the deliberate and preplanned movement of COOP personnel to an alternate 
facility. Furthermore, agencies did not fully identify the levels of resources necessary to 
support their essential functions. 

Although individual agencies are responsible for developing a viable COOP plan and 
ensuring that their alternate facilities are adequately prepared, FEMA's limited efforts in 
overseeing and assessing agency COOP capabilities contributed to agencies' lack of 
compliance with all of the FPC 65 guidance. 
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Site Selection 

FPC 65 states that agencies must identify and prepare alternate facilities as part of their 
COOP plans. The guidance requires that if the selected facility is not owned or leased by the 
agency, a signed memorandum of agreement/understanding (MOA/MOU) must be prepared 
with the owner or occupant of the facility and reviewed annually. Furthermore, agencies 
should consider access from the alternate facility to essential resources — such as food, 
water, fuel, medical facilities, and municipal services. Agencies should also have the ability to 
run emergency power at their alternate facilities. When selecting their alternate facilities, 
agencies should perform an all-hazard risk assessment for any facility considered for COOP 
use. This assessment should consist of an analysis that includes identification of all natural 
hazards that may affect each facility. 

All six agencies identified their alternate facilities, and the one agency that shares its 
alternate facility with its owners had a documented MOA. Most agencies considered access 
to essential resources and had the ability to run emergency power. However, only one of the 
agencies documented that it had performed the required all-hazard risk assessments when 
selecting the identified alternate facilities. If an agency does not conduct an all-hazard risk 
assessment before selecting a facility, it may select a site that is unduly susceptible to 
(1) natural hazards; (2) accidents, such as releases of hazardous materials; (3) crime, 
sabotage, and terrorist attacks; or (4) inadequate capabilities of on-site and/or local first 
responders to accommodate the needs of the relocating agency. 
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Site Selection 



Site Selection: Responses by Question 



Question 


Yes 


Partial 


No 


N/A 


Does the agency identify an alternate facility as a part of 
its COOP plan? 


6 





. 





If an alternate facility is not owned or leased by the 
agency, does the agency have a signed Memorandum of 
Agreement/Understanding (MOA/MOU)? 


1 







5 


Did the agency consider access to essential resources 
such as food, water, fuel, medical facilities, and municipal 
services from the alternate facility? 


5 


1 







Does the agency have the ability to run emergency power 
at the alternate facility to allow essential functions and 
operations to continue? 


4 


1 


• 


1 a 


Did the agency perform an all-hazard risk assessment for 
the alternate facility? 


1 


2 


3 






Source: GAO analysis of agency alternate facilities and continuity planning documents. 

a One agency documented that it would relocate to its alternate facility selected for this assessment only if the building is 
operational; otherwise it would relocate to one of its other alternate facilities. 
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Facility Plans and Procedures 

FPC 65 states that agencies must have detailed site preparation and activation plans in 
order to achieve full operational capability within 12 hours of notification. Additionally, the 
agency must plan for notifying the alternate facility upon COOP activation and provide 
instructions to COOP personnel for relocating to its alternate facility. Furthermore, an 
agency must have plans for in-processing of COOP personnel upon arrival at the alternate 
facility and plans to address the housing of COOP personnel, if applicable. 

Most agencies documented site preparation and activation plans and procedures, 
documented plans to notify their alternate facilities upon COOP activation, and provided 
instructions for relocating to their alternate facilities. Most agencies also documented plans 
for reception and in-processing of COOP personnel. Three agencies reported that housing 
plans were not applicable because their alternate facilities were at a commutable distance 
for COOP personnel. Of the other three agencies, two documented plans to address 
housing for the relocated employees. 
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Facility Plans and Procedures: Responses by Question 



Question Yes Partial No N/A 

Does the agency have a site preparation and activation 

plan pre-positioned at the alternate facility? 5 10 



Does the agency have a plan for notifying alternate 
facilities at the time of COOP activation? 



Does the agency provide instructions for relocating to 
alternate facilities? 


5 


1 








Does the agency have procedures for the reception and 
in-processing of personnel at the alternate facility? 


4 


2 










Does the agency have a plan to address housing for 
COOP personnel, if applicable? 


2 


1 







3 



Source: GAO analysis of agency alternate facilities and continuity planning documents. 
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Employee Health, Safety, Emotional Well-being, and Security 

FPC 65 states that alternate facilities must provide consideration for the health, safety, 
emotional well-being, and security of relocated employees. The guidance calls for 
agencies to have sufficient personnel and technology to provide perimeter and access 
control, internal security functions, and surveillance of the facility. Physical security at the 
alternate facility must meet the requirements established by annual threat assessments 
and physical security surveys by the agency's security office, the Federal Protective 
Service, or a qualified contractor. 

All six agencies provided consideration for the health and safety of relocated COOP 
personnel. For example, one agency's alternate facility provided medical support on site 
while another was equipped with first aid supplies. In addition, the six agencies provided 
consideration for the emotional well-being of relocated COOP personnel. For example, 
one agency's facility included an employee assistance program office staffed with 
counselors, while another provided a recreation area for off-shift relaxation. 

At all six agency alternate facilities that we visited, physical access to the facilities was 
controlled through the use of guards, identification badges, or entry devices such as key 
cards. Three agencies documented that they had conducted all of the required physical 
security surveys and threat assessments. If an agency does not conduct the necessary 
physical security assessments and surveys, it may be unaware of vulnerabilities at its 
alternate facility and, therefore, unable to address them. 
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Objective 1 : Alternate Facilities Compliance 

Employee Health, Safety, Emotional Well-being, and Security 



Employee Health, Safety, Emotional Well-being, and Security: Responses by Question 



Question 


Yes 


Partial 


No 


N/A 


Does the agency provide consideration for the health and 
safety of relocated COOP personnel? 


6 










Does the agency provide consideration for the emotional 
well-being of relocated COOP personnel? 


6 










Is access to facilities controlled through the use of guards, 
identification badges, or entry devices such as key cards 
or biometrics? 


6 










Does the agency provide physical security that meets all 
requirements established by annual threat assessments 
and physical security surveys? 


3 


3 








Source: GAO analysis of agency alternate facilities and continuity planning documents. 
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Alternate Facility Space 

FPC 65 requires agencies to establish staffing requirements needed to perform essential 
functions within 12 hours of COOP activation and for up to 30 days. In addition, the 
guidance states that agencies must ensure that alternate facilities have enough space to 
accommodate the maximum number of relocating personnel they require. 

All six agencies identified the maximum number of COOP personnel that could relocate to 
their alternate facilities. Four of those agencies provided adequate space to accommodate 
the maximum number of staff indicated in their staffing plans. The other two agencies did 
not provide enough space at their alternate facilities to accommodate all of the relocating 
COOP personnel. Officials from those two agencies stated that the number of COOP 
personnel simultaneously relocating to their facilities would be less than the maximum 
number of personnel identified, although they were unable to provide documentation to 
support this. 

If agencies do not establish clear staffing requirements for their alternate facilities, the 
allocated space at the facilities may be insufficient to accommodate COOP personnel 
needed to perform agency essential functions. 
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Alternate Facility Space: Responses by Question 



Question 


Yes 


Partial 


No 


N/A 


Does the agency identify the maximum number of 
personnel that could relocate to the alternate facility? 


• 










Does the agency identify sufficient space at the alternate 
facility to accommodate the number of personnel 
identified to relocate there? 


4 


2 









Source: GAO analysis of agency alternate facilities and continuity planning documents. 
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Equipment 

FPC 65 requires that agencies identify the critical resources — including IT and 
telecommunications equipment — needed to perform essential functions. Agencies must 
pre-position critical resources at the alternate facility to ensure the availability of services. 
In addition, agencies should (1) have procedures for ordering equipment and supplies not 
already in place at the alternate facility and (2) annually review their lists of resources 
required to perform essential functions and update them as necessary. 

All six agencies identified types of equipment they would need to perform essential 
functions at their alternate facilities, but four agencies did not identify both types and 
quantities. For example, one agency required computers at its facility but did not specify 
how many. Because of the unclear requirements for the four agencies, we were unable to 
determine whether all necessary resources were pre-positioned at their facilities. In 
addition, four agencies had procedures for ordering equipment and supplies, and one 
agency demonstrated that it annually reviewed its lists of equipment. If an agency does 
not identify equipment requirements for the alternate facility, it cannot be assured that the 
current level of resources present at its alternate facility is adequate for performing the 
essential functions. 
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Equipment: Responses by Question 



Question 


Yes 


Partial 


No 


N/A 


Does the agency establish requirements for equipment 
(including IT and telecommunications hardware) needed 
to perform essential functions? 


2 


4 







Has the agency pre-positioned equipment, as identified, at 
the alternate facility? 3 


2 




- 




Does the agency identify the office supplies needed to 
perform essential functions? 


2 


3 







Does the agency have procedures for ordering equipment 
and supplies not already in place at the alternate facility? 


4 


2 


• 





Does the agency annually review its lists of equipment 
required to perform essential functions and update them 
as necessary? 


1 





5 






Source: GAO analysis of agency alternate facilities and continuity planning documents. 

a 4 of the 6 agencies did not document specific requirements for pre-positioned equipment, so we could not assess their 
compliance for this question. 
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Vital Records 

FPC 65 states that agency personnel must have access to electronic and hard-copy vital 
records and databases needed to perform their essential functions from the agency alternate 
facility. In order for an agency to establish access requirements for vital records and 
databases at the alternate facility, it must develop a vital records inventory with location and 
access information for each vital record. The guidance also states that an agency must 
develop and maintain a vital records plan packet that includes — among other items — agency 
contact information, lists of records recovery experts and vendors, and its vital records 
inventory. 

One of the six agencies maintained an inventory that included location and access 
information for each vital record and database required to perform essential functions at the 
alternate facility. For the remaining five agencies, which lacked complete inventories, we 
could not fully assess whether the necessary electronic and hard copy vital records would be 
available at the facilities. Furthermore, only one out of the six agencies had a complete vital 
records plan packet at its alternate facility. If an agency does not maintain a complete 
inventory of the vital records and databases needed to perform essential functions, it will be 
unable to determine whether the records necessary for performing agency essential 
functions will be available at the alternate facility. 
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nSS^^™ Accountability * Integrity * Reliability 

Vital Records: Responses by Question 


Question 


Yes 


Partial 


No 


N/A 


Does the agency establish requirements for vital records 
and databases needed to support its essential functions 
in an inventory that includes location and access 
information? 


1 


5 


• 





Does the agency provide the capability to access its 
classified and unclassified vital records and databases 
from the alternate facility? 3 


1 




_ 





Does the agency have a vital records plan packet? 







Does the agency provide the procedures for moving non- 
pre-positioned vital records from the primary to the 
alternate facility in event of COOP activation? 








Source: GAO analysis of agency alternate facilities and continuity planning documents. 

a 5 of the 6 agencies did not adequately document requirements for vital records and databases, so we could not assess their 
compliance for this question. 
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Objective 1 : Alternate Facilities Compliance 

Vital Records 



Vital Records: Responses by Question (continued) 



Question 


Yes 


Partial 


No 


N/A 


Does the agency outline procedures for updating vital 
records to ensure that they always contain the most 
current information? 




3 


■ 





Did the agency conduct a risk assessment for its vital 
records? 


• 





■ 





Does the agency identify individuals that can assist with 
recovery from potential records damage? 


CO 











Source: GAO analysis of agency alternate facilities and continuity planning documents. 
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Voice and Data Communications 

The success of agency operations at an alternate facility depends on the availability of voice 
and data communication methods. FPC 65 states that an agency must have redundant 
communications systems at its alternate facility. Furthermore, an agency must have the 
ability to communicate with key contacts, including (1) agency staff — such as COOP 
personnel, agency leadership, and other employees operating from different locations — and 
(2) external entities, such as the FEMA Operations Center, the Homeland Security 
Operations Center, critical customers, and the public. The guidance also states that an 
agency must be able to access from its alternate facility its critical information systems and 
data, a local area network, and internal and external e-mail and archives. 
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Although most agencies provided redundant emergency communications methods at their 
alternate facilities, four agencies did not fully document procedures for how they would 
communicate with key internal and external entities using these methods. For example, two 
agencies provided information on how to contact others but did not have clear procedures 
demonstrating how they would receive incoming communications at their alternate facilities. 

In addition, three out of the six agencies did not specifically document the data and critical 
information systems needed for essential functions. For example, one agency identified a 
general need for access to file servers, but did not identify the specific critical information 
systems and data within the servers. As a result, we were unable to determine whether all 
necessary systems and data would be accessible from the alternate facilities. Most agencies 
provided access to a local area network, and two provided access to internal and external e- 
mail and archives. 

If the ability to communicate with internal and external entities is limited, essential agency 
operations may also be limited. Furthermore, if agencies do not identify the critical 
information systems and data needed to perform essential functions, they cannot ensure that 
personnel will be able to access the information resources necessary to perform these 
functions at the alternate facility. 
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Objective 1 : Alternate Facilities Compliance 

Voice and Data Communications 



Voice and Data Communications: Responses by Question 



Question 


Yes 


Partial 


No 


N/A 


Does the agency provide communications capabilities at 
the alternate facility of sufficient quantity and mode/media 
to effectively interface with key contacts? 


2 


4 







Does the agency provide redundant communications 
systems for use in COOP implementation within 12 hours 
of COOP activation and sustained for up to 30 days? 


5 


1 







Does the agency establish requirements for data and 
critical information systems needed to conduct essential 
functions and support activities? 


3 


2 







Does the agency provide access to critical information 
systems and data within 12 hours of COOP activation? 3 




1 


2 




Does the agency provide access to a local area network 
within 12 hours of COOP activation? 


4 


2 








Does the agency provide access to internal and external 
e-mail and archives within 12 hours of COOP activation? 


2 


2 


2 






a 3 of the 6 agencies did not adequately document requirements for critical information systems and data, so we could not 
assess their compliance for this question. 
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Tests and Exercises 

Tests and exercises of continuity of operations capabilities are essential to demonstrate and 
improve an agency's ability to execute its COOP plans and procedures. FPC 65 provides for 
multiple test and exercise requirements that directly impact the preparedness of agency 
alternate facilities, including (1) annual exercises that incorporate the deliberate and 
preplanned movement of the COOP personnel to an alternate facility; (2) quarterly validation 
of internal and external communications capabilities at an alternate facility; and (3) tests to 
ensure that vital records and data to support essential functions are sufficient, complete, 
current, and available at an alternate facility. 

None of the agencies documented that they conducted all of the required tests and exercises 
related to the preparation of alternate facilities that are required by FPC 65, including 
annually testing primary backup infrastructure systems and services at the alternate facilities. 
If an agency does not plan, conduct, and document the necessary tests and exercises of its 
COOP plans and procedures, it will be unable to ensure that (1) agency personnel are 
familiar with alert, notification, and deployment procedures; (2) resource requirements at the 
alternate facility are adequate for performing essential functions; and (3) any deficiencies in 
their plans and procedures are identified and corrected. 
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Tests and Exercises: Responses by Question 


Question 


Yes 


Partial 


No 


N/A 


Does the agency test annually its primary and backup 
infrastructure systems and services at its alternate facility 
(e.g., power, water, fuel)? 





2 


4 





Does the agency conduct annual exercises that 
incorporate the deliberate and preplanned movement of 





5 








the COOP personnel to an alternate facility? 



Does the agency annually test/exercise its required 
physical security capabilities? 



Does the agency test to ensure that vital records and data 
are sufficient, complete, current, and available? 





2 


• 





Has the agency documented the quarterly validation of its 
internal and external communications capabilities at its 
alternate facility? 





4 







Source: GAO analysis of agency alternate facilities and continuity planning documents. 
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Although individual agencies are responsible for developing a viable COOP plan and 
ensuring that their alternate facilities are adequately prepared, FEMA's limited efforts in 
overseeing and assessing agency COOP capabilities contributed to agencies' lack of 
compliance with all of the FPC 65 guidance. For example, FEMA has continued to rely on 
agency-reported information as the basis for its assessments. According to DHS comments 
on a draft of this briefing, FEMA uses its Forward Challenge series of interagency COOP 
exercises, which occur every 2 years, as its external assessment for all executive branch 
agencies. However, participating agencies completed assessments of their own COOP 
capabilities during the most recent exercise. In addition, FEMA collects COOP readiness 
status reports from agencies and provides consolidated reports to White House and DHS 
officials. 

During our previous reviews of agency COOP plans in 2002 and 2004, we raised similar 
concerns. In response, FEMA officials reported that the agency was developing a readiness 
reporting system to assist it in assessing agency plans. FEMA officials reported that the 
online system was to be completed in March 2005 and to be operational and certified by 
October 2005. 

However, FEMA recently terminated testing and development of its readiness reporting 
system, citing design issues and stating that the system could not be implemented at the 
required scale. According to Office of National Security Coordination officials, an internal 
working group was established to develop system requirements and a new statement of 
work, although no time line has been established for development of a new system. 
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FEMA officials previously identified the agency's coordination of interagency COOP 
exercises as an effort that helps in ensuring the COOP readiness and capabilities of 
executive branch agencies. According to officials from the Office of National Security 
Coordination, the agency coordinated Determined Challenge, an interagency table-top 
exercise conducted in November 2005 that included participants from 46 departments and 
agencies. FEMA also continues its planning efforts for Forward Challenge 06, its upcoming 
interagency exercise in June 2006. Officials stated that about 60 departments and agencies 
will participate in the exercise from their alternate facilities. Officials anticipate using 
independent observers to evaluate agency plans and their implementation during the 
exercise. 

Although participation in FEMA's interagency exercises can help agencies to assess and 
validate their COOP plans and procedures, it does not ensure that agencies meet all FPC 65 
requirements for tests and exercises. For example, the guidance calls for agency exercises 
to incorporate the movement of COOP personnel to their alternate operating facilities, and 
for these exercises to be conducted annually. However, FEMA coordinates such exercises 
only every 2 years. 1 



1 Forward Challenge 06 and its predecessor, Forward Challenge 04, are examples of exercises that can incorporate the 
movement of COOP personnel to agency alternate facilities. 
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We previously reported that the White House initiated an effort — in coordination with 
FEMA — to identify and validate the mission essential functions of executive branch agencies. 
In a memorandum issued on January 10, 2005, the Assistant to the President for Homeland 
Security initiated the process, stating that once identified, mission essential functions would 
serve as key continuity planning factors for agencies' determination of the appropriate level 
of staffing, communications, and facilities. Initial plans were to use the validated functions to 
support, among other things, the development of new continuity policy and to develop and 
implement improved requirements. 

However, officials from FEMA's Office of National Security Coordination stated that oversight 
efforts to review agency essential functions were postponed until the council develops and 
releases further continuity policy. One official stated that the council informally reviewed 
essential functions for four agencies before the postponement, but did not provide formal 
written comments or revisions of essential functions to the agencies. No time line has been 
set for resuming the essential function review. 

Identification of essential functions is crucial to the development of continuity plans and 
preparation of alternate facilities. Thus, until essential functions are reviewed and validated 
against consistent criteria, FEMA and the Homeland Security Council will lack assurance that 
agencies have made adequate preparations for alternate facilities, including provisions for 
necessary resources and staffing levels. 
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In his comments on a draft of this briefing, the Director of the Department of Homeland 
Security's GAO/OIG Liaison Office stated that FEMA has plans to expand its COOP 
oversight activities to include the evaluation and assessment of individual agency COOP 
capabilities. He added that, as part of the methodology for the upcoming interagency 
exercise, Forward Challenge 06, agency COOP plans will be externally evaluated before the 
exercise. In addition, officials plan to conduct individual agency COOP assessments starting 
in July 2006. These assessments will include the evaluation of, among other things, agency 
COOP plans and procedures; essential functions; alternate facilities; and tests, training, and 
exercises. FEMA officials plan to conduct two agency assessments per month, with 
assessment reports to be provided beginning in late August 2006. However, according to an 
Office of National Security Coordination official, details regarding the assessment's 
methodology have yet to be finalized. 

Conducting assessments of agency COOP capabilities can help agencies validate their plans 
and procedures and identify any deficiencies for correction. However, if FEMA does not 
develop a methodology for individual agency COOP assessments that evaluates agencies' 
compliance with FPC 65 — including the extent to which they (1) identify essential functions, 
(2) identify the levels of staff and resources required at their alternate facilities, and (3) plan, 
conduct, and document the necessary tests and exercises at the appropriate scope and 
frequency — it will lack assurance that agencies have taken the steps necessary to ensure 
that they will be able to perform essential government operations following a disruption. 
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More agencies reported plans for essential team members to telework during a COOP event 
than in our previous survey, but few documented that they had made the necessary 
preparations to effectively use telework during an emergency. Although FPC 65 does not 
require agencies to use telework during a COOP event, it does state that they should 
consider the use of telework in their continuity plans and procedures. All of the 23 agencies 
that we surveyed indicated that they considered telework as an option during COOP 
planning. In addition: 

• Nine of the 23 agencies reported that some of their COOP essential team members are 
expected to telework during a COOP event. However, only one agency documented that 
it had notified its team members of their expectation to telework during a COOP event. 

• None of the 23 agencies demonstrated that they can ensure adequate technological 
capacity to allow designated personnel to telework during a COOP event. 

• Only 3 of the 23 agencies documented testing the ability of staff to telework during a 
COOP event. 

Reasons cited for not planning to use telework during a COOP event included (1) the need to 
access classified information — which is not permitted outside of secured areas — in order to 
perform agency essential functions and (2) a lack of funding for the necessary equipment 
acquisition and network modifications. 
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Objective 2: Telework 

Telework Practices 



Telework: Responses by Question 

The following tables summarize the most recent agency responses to questions on the use 
of telework in responding to disruptions to operations. For comparison, we also provide 
responses from the survey we conducted in 2004. 



Question 



Year 



Yes 



Yes a 

(no doc) 



No 



Does the agency have a telework policy? 



2005 



2004 b 



22 



19 



1 



If yes, does the policy specifically address COOP events? 



2005 



2004 



15 



19 



Does the COOP plan specifically address telework? 



2005 



2004 



12 



19 



Does the agency coordinate its COOP and telework planning 
processes? 



2005 



2004 



13 



17 



Was the agency's telework coordinator involved in COOP 
planning? 



2005 



2004 







14 



16 



Source: Analysis of agency responses to GAO questions. 

a Agencies provided a positive response but did not provide adequate documentation to support their response. 

b In 2004, one agency did not respond, resulting in a total of 22 responses for that year versus 23 responses for 2005. 
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Telework: Responses by Question (cont'd) 



Question 


Year 


Yes 


Yes a 

(no doc) 


No 


Are any of the COOP essential team members expected to 


2005 


3 


6 


14 


telework in a COOP event? 


2004 


1 


2 


19 


Were staff informed of their responsibility to telework 


2005 


1 


10 


12 


during a COOP event? 


2004 


1 


3 


18 


Has the agency ensured that it has adequate technological 


2005 





14 


9 


capacity for staff to telework during a COOP event? 


2004 





5 


17 


Will the agency provide technological assistance to staff 


2005 


3 


11 


9 


during a COOP event? 


2004 





5 


17 


Did the agency train staff how to telework during a COOP 


2005 





13 


10 


event? 


2004 





3 


19 


Has the agency tested the ability of staff to telework during 


2005 


3 


7 


13 


a COOP event? 


2004 





2 


20 



Source: Analysis of agency responses to GAO questions. 

a Agencies provided a positive response but did not provide adequate documentation to support their response. 
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Telework: Responses by Question (cont'd) 



Question 


Year 


Yes 


Yes a 

(no doc) 


No 


Are any personnel not designated essential for COOP 


2005 





11 


12 


purposes expected to telework during an emergency? 


2004 





7 


15 


Were staff informed of their responsibility to telework 


2005 


1 


5 


17 


during a COOP event? 


2004 





3 


19 


Has the agency ensured that it has adequate technological 


2005 





8 


15 


capacity for staff to telework during a COOP event? 


2004 





7 


15 


Will the agency provide technological assistance to staff 


2005 





7 


16 


during a COOP event? 


2004 





5 


17 


Did the agency train staff how to telework during a COOP 


2005 





4 


19 


event? 


2004 





1 


21 


Has the agency tested the ability of staff to telework during 


2005 





4 


19 


a COOP event? 


2004 





3 


19 



Source: Analysis of agency responses to GAO questions. 

a Agencies provided a positive response but did not provide adequate documentation to support their response. 
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No guidance addresses the steps that agencies should take to ensure that they are fully 
prepared to use telework during a COOP event. When we reported the results of our 2004 
survey, we recommended that the Secretary of Homeland Security direct the Under 
Secretary for Emergency Preparedness and Response to develop, in consultation with OPM, 
guidance on the steps that agencies should take to adequately prepare for the use of 
telework during a COOP event. However, to date, no such guidance has been created nor 
has a time line been established for its creation. 

FEMA recently disseminated guidance to agencies regarding the incorporation of pandemic 
influenza considerations into COOP planning. While the guidance does suggest the use of 
telework during such an event, it does not address the steps agencies should take when 
preparing to use telework during an emergency. 

Without guidance on what constitutes adequate preparation, including tests and training, 
agencies are unlikely to take all the steps necessary to ensure that employees will be able to 
effectively use telework to perform essential functions during any COOP event, including an 
influenza pandemic. 
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Conclusions 



All six agencies we reviewed took steps to prepare their alternate facilities for use in 
emergencies. However, none of the agencies followed all of FEMA's guidance. For example, 
none conducted all the applicable tests and exercises required by FPC 65, including annual 
exercises that incorporate the deliberate and preplanned movement of COOP personnel to 
an alternate facility. Furthermore, agencies did not fully identify the levels of resources 
necessary to support their essential functions, creating a lack of assurance that their facilities 
are adequately prepared to support agency essential functions. 

Although individual agencies are responsible for developing viable COOP capabilities, 
FEMA's limited oversight contributed to the lack of agency compliance with all of the FPC 65 
guidance for alternate facilities. FEMA recently announced plans to expand its assessments 
of individual agency COOP plans, but has not yet determined how these new assessments 
will take place. If FEMA does not conduct timely assessments of the plans developed by the 
six agencies included in our review, it will lack assurance that those agencies are fully 
prepared to use the upcoming interagency exercise to demonstrate their readiness. Also, 
until FEMA conducts independent assessments of all agencies' compliance with FPC 65 — 
including the extent to which agencies (1) identify essential functions, (2) identify the levels of 
staff and resources required at their alternate facilities, and (3) plan, conduct, and document 
the necessary tests and exercises at the appropriate scope and frequency — it will lack 
assurance that agencies have taken the steps necessary to ensure that they will be able to 
perform essential government operations following a disruption. 
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Conclusions 



After the 2004 version of FPC 65 was issued, which included a requirement to consider the 
use of telework, more agencies than in our previous survey reported plans to use telework to 
some extent during COOP events. However, although some of these agencies reported 
making related preparations, the general lack of documentation to support their responses 
indicates that few are likely to have fully implemented the telework preparations that we have 
previously found to be effective. Although FEMA recently provided additional guidance on the 
use of telework, it did not address the steps agencies should take to prepare to use telework 
during an emergency event, nor has a time line been established for when such guidance 
may be written. Without guidance on what constitutes adequate preparation for using 
telework during an emergency situation, it will be difficult for agencies to identify and perform 
the necessary steps to ensure that their teleworking staff will be able to perform essential 
functions during a COOP event. 
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Recommendations for Executive Action 



To ensure that agencies are adequately prepared to continue performing essential functions 
following an emergency, we recommend that the Secretary of Homeland Security direct the 
FEMA Director to improve the oversight of agency COOP planning by taking the following 
actions: 

• Before the upcoming interagency exercise, conduct an assessment of the COOP plans of 
the six agencies whose alternate facilities were included in our review and report any 
deficiencies found to the head of the agency for correction. 



Develop a methodology for individual agency COOP assessments that independently 
evaluates executive branch agencies' compliance with FPC 65, including the extent to 
which agencies (1) identify essential functions; (2) identify the levels of staff and 
resources required at their alternate facilities; and (3) plan, conduct, and document the 
necessary tests and exercises at the appropriate scope and frequency. The methodology 
should include a mechanism for reporting any deficiencies found to the head of the 
agency for correction. 

Establish a time line for developing, in consultation with OPM, guidance on the steps that 
agencies should take to adequately prepare for the use of telework during a COOP event. 
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In written comments provided on a draft of this briefing, the Director of the Department of 
Homeland Security's GAO/OIG Liaison Office stated that continuity planning is the 
responsibility of individual departments and agencies. We agree and we clarified our draft to 
more clearly identify the responsibility of agencies for their own continuity planning. The 
Director also identified actions that FEMA had taken to fulfill its responsibilities for 
coordination, guidance and advice, support, and periodic assessment of agency continuity 
planning. However, the list of responsibilities provided by the Director excludes the 
responsibility to oversee and assess the status of COOP capability across the federal 
executive branch, which is outlined in FPC 65. We revised our briefing to emphasize our 
conclusion that FEMA's ongoing reliance on self-reported information from the departments 
and agencies constitutes a limited level of oversight that contributes to the lack of full 
compliance with FEMA's continuity planning guidance. 

The Director also identified recently published guidance on telework, as well as FEMA's 
guidance to agencies regarding continuity considerations for pandemic influenza. We 
updated our briefing to include these recent developments. However, neither the guidance 
issued by FEMA nor the additional telework guidance addresses the preparations necessary 
for agencies to ensure that they are prepared to use telework following a COOP event. 
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k GAP 

Accountability * Integrity * Reliability 



Attachment 1 : Agencies Participating in Telework Survey 



Department of Agriculture 

Department of Commerce 

Department of Education 

Department of Energy 

Department of Health and Human Services 

Department of Homeland Security 

Department of Housing and Urban Development 

Department of Justice 

Department of Labor 

Department of State 

Department of the Interior 

Department of the Treasury 

Department of Transportation 

Department of Veterans Affairs 



Agency for International Development 

Environmental Protection Agency 

General Services Administration 

National Aeronautics and Space Administration 

National Science Foundation 

Nuclear Regulatory Commission 

Office of Personnel Management 

Small Business Administration 

Social Security Administration 
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U.S. par tnn-vjt of liunrc-Linti Security 

Washington. D.C. 2(M72 




Homeland 
Securily 



May 5, 2006 



Ms. Linda D. fCoontz 

Director, Information Management Issues 

U.S. Government Accountability Office 

441 G Street, NW 

Washington, D.C. 20548 

Dear Ms. Koontf: 

Thank you for the opportunity to review and comment on the Government Accountability 
Office's (GAO's) draft report GAO-06-713 entitled Continuity of Operations (COOP): 
Selected Agencies Could Improve Manning for Use of Alternate Facilities and Tetework 
During Disruptions, The Department of Homeland Security (DHS) recommends the 
following changes be made to the report's recommendations and findings: 

Comments on GAP Recommendations 

GAP Introduction : To ensure that agencies are adequately prepared to continue performing 
essential functions following an emergency, we recommend that the Secretary of Homeland 
Security direct the Federal Emergency Management Agency (FEMA) Director to improve 
the oversight of agency COOP planning by taking the following actions: 

DHS Comment : Presidential Decision Directive 67 (PDD 67) directs that an Interagency 
Advisory Group (I AG) shall provide coordination, oversight, and management for COOP 
related activities of executive branch civil departments and agencies. Although FEMA is 
designated as chair of this group, principal members' departments and agency emergency 
coordinators are designated with the authority to represent and commit their departments and 
agencies in matters relating to COOP. Since departments and agencies have the ultimate 
authority to commit their organizations to the coordination, oversight, and management 
recommendations of the I AG, recommend the GAO recommendation be changed to read, 
"...FEMA Director to improve the readiness of agency COOP programs by taking the 
following actions:" 

GAO Recommendation One : Before the upcoming interagency exercise, conduct an 
assessment of the COOP plans of the six different agencies whose alternate facilities were 
included in our review and report any deficiencies found to the head of the agency for 
correction. 
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DHS Comment : We partially concur with this recommendation. FEMA will conduct the 
assessment of the six agencies in conjunction with the upcoming Top Officials/Forward 
Challenge 06 Exercise. 

CAP Recommendation Two : Develop a methodology for individual agency COOP 
assessments that independently evaluates executive branch agencies' compliance with 
Federal Preparedness Circular 65 (FPC 65), including the extent to which agencies (1) 
identify essential functions; (2) identify the levels of staff and resources required at their 
alternate functions; and (3) plan, conduct, and document the necessary tests and exercises 
at the appropriate scope and frequency. The methodology should include a mechanism 
for reporting any deficiencies found to the head of the agency for correction. 

DHS Comment : We partially concur with this recommendation. FEMA currently has an 
assessment program and plans to continually refine its assessment methodology and 
expand the program through additional funding and resources. We believe the 
recommendation should reflect this reality by beginning, "Refine the methodology for 
individual agency COOP assessments. . .". 

GAP Recommendation Three : Establish a timeline for developing, in consultation with the 
Office of Personnel Management (PPM), guidance on the steps that agencies should take to 
adequately prepare for the use of telework during a CPPP event. 

DHS Comment : We partially concur with this recommendation. FEMA will continue to work 
with the government lead agent for telework, PPM, to provide further guidance on telework, 
recognizing that this is a valuable tool for improving continuity preparedness. FEMA will 
coordinate with OPM in the development of the timeline for telework guidance. In FPC 65, 
FEMA provides guidance to departments and agencies to consider when identifying and 
preparing alternate operating facilities for continuity operations. Options include giving 
consideration to telecommuting locations, work at home agreements, virtual offices, and joint 
or shared facilities (FPC 65, page E-l). FEMA and OPM provided further guidance and 
instruction on the potential use of telework during a COOP event, along with other personnel 
management options, during several Interagency COOP Working Group meetings during the 
past two years. These meetings were well attended by the COOP community and the 
presentation material received high praise for its usefulness. Minutes and presentation 
material from all meetings were distributed to all Interagency COOP Working Group 
members, even if not in attendance at a particular meeting. This includes guidance and 
consideration for telework during this and other continuity events. 

Comments on GAP Findings 

In addition to the Department's comments on the recommendations, we believe that a 
number of findings should be changed to more accurately reflect FEMA's actions in 
support of COOP preparedness, as well as our assigned responsibilities. 

• Where GAO refers to "FEMA's limited efforts...," DHS believes this verbiage 
should be changed to "FEMA's limited resources. . ." 
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FEMA's efforts are constrained by resources. Notwithstanding this limitation, FEMA has 
provided extensive guidance and assistance and conducted numerous training and exercise 
activities across the country to assist the Federal executive branch in its COOP preparedness 
(see DHS's April 10, 2006 reply to the GAO's draft briefing entitled Continuity of 
Operations: Selected Agencies Could Improve Planning for Use of Alternate Facilities and 
Telework During Disruption). To improve the readiness of the Federal government's COOP 
program, additional FEMA resources are required to support the large number of Federal 
offices and facilities that could benefit from recurring COOP assessments throughout the 
nation. 

• References to FEMA as "executive agent" should be changed to FEMA as "lead 
agent." 

Presidential Decision Directive 67 identifies FEMA as the lead agent for COOP. Although 
previous indications have been made referencing FEMA as executive agent, Presidential 
direction specifies FEMA as lead coordinating agency for COOP activities. 

• References to tests and exercises "required" by FPC 65 should be reworded to 
indicate that such efforts are "recommended" by FPC 65. 

Federal Preparedness Circulars are guidance and coordination documents and not directives 
per guidance in FPC 1 A, Federal Preparedness Circular. 

• DHS suggests that references to FEMA's assessment methodology utilize the 
following language: "If FEMA does not refine its current assessment 
methodology... it will diminish the capability to assure agencies have taken the steps 



FEMA currently has an assessment methodology, which includes: 
FEMA Assessment Methodology 

• FEMA developed a COOP Self-Assessment Tool in 2004 (updated in 2005) to assist 
senior leaders and their COOP coordinators in performing internal reviews/audits of their 
COOP plans and programs. 

• FEMA will continue to use the Forward Challenge series of exercises as its biennial 
COOP external assessment for executive branch departments and agencies. Planning is well 
along on completing this during the June 2006 Top Official 4/Forward Challenge 06 
(T4/FC06) exercise. In March 2006, FEMA completed development of its plan for an 
expanded comprehensive department and agency COOP assessment program. FEMA will 
provide further COOP assessment guidance to departments and agencies in addition to the 
requirements associated with the biennial full-scale COOP exercises. The table below 
outlines the major components of this program. 
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Compile Department and Agency COOP Plans (Part of 
T4/FC06 exercise evaluation methodology) 


May 1, 2006 


Complete External COOP Plan Evaluation for each 
Department and Agency (T4/FC06 Assessments) 


May 3 1,2006 


Schedule published for the expanded Department and 
Agency External Assessment Program (New External 
Assessment Program) 


June 15, 2006 


Conduct external COOP evaluations for Departments and 
Agencies during T4/FC06 Exercise 


June 20-21,2006 


Conduct Department and Agency COOP Assessments to 
include: Plans and Procedures; Essential Functions; 
Delegations of Authority; Orders of Succession; Alternate 
Operating Facilities; Interoperable Communications; 
Vital Records and Databases; Human Capital; Test, 
Training, and Exercises; Devolution of Control and 
Direction; Reconstitution; and Telework 


July 30, 2006 
Assess 2 Departments 
and Agencies per month 


Provide Assessment Reports 


Beginning August 3 1 , 2006 



Through this program, FEMA will continue to refine upon its assessment program that was 
initiated during the Forward Challenge 2004 exercise. 



Thank you again for the opportunity to comment on this draft report and we look forward to 
working with you on future homeland security issues. 



Sincerely, 



Steven J. Pecinovsky " 
Director 

Departmental GAO/OIG Liaison Office 



(310759) 
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constitutional responsibilities and to help improve the performance and 
accountability of the federal government for the American people. GAO 
examines the use of public funds; evaluates federal programs and policies; 
and provides analyses, recommendations, and other assistance to help 
Congress make informed oversight, policy, and funding decisions. GAO's 
commitment to good government is reflected in its core values of 
accountability, integrity, and reliability. 
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